CVE-2026-81091
Received Received - Intake

Proxy Middleware SSRF in mcp-use Inspector

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81091
EUVD
EUVD-2026-67146

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mcp-use mcp-use to 2.3.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81091 is a Server-Side Request Forgery (SSRF) vulnerability in mcp-use's inspector proxy middleware. It allows attackers to specify arbitrary target URLs via the X-Target-URL header or __mcp_target parameter without proper host validation. The proxy forwards requests to loopback, link-local, private, or internal addresses, enabling access to restricted systems. Redirects from the target are not revalidated, allowing further exploitation.

Detection Guidance

To detect this SSRF vulnerability in mcp-use's inspector proxy, check if your system is running affected versions (2.3.2 or earlier). Inspect network traffic for requests to loopback, private, or link-local addresses via headers like X-Target-URL or parameters like __mcp_target. Use tools like curl to test if the proxy forwards requests to internal addresses.

Impact Analysis

An attacker could exploit this to make the server send requests to internal systems, read sensitive responses, or access restricted services. This could lead to data leaks, unauthorized access to internal APIs, or further network reconnaissance. Systems running vulnerable mcp-use versions (2.3.2 or earlier) are at risk.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data to unauthorized parties. GDPR may be impacted if personal data is leaked, while HIPAA could be breached if protected health information is accessed. Organizations must ensure proper network segmentation and access controls to mitigate risks.

Mitigation Strategies

Immediately update mcp-use to versions beyond 2.3.2 where the isSafeProxyTarget validation is implemented. Disable the inspector proxy if not needed. Restrict network access to the proxy server and monitor for unusual outbound requests to internal or restricted addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81091. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart